Offering regional and national programs, CIO (and CSO) events bring together some of the most respected names and thought leaders in information technology and security. Presented by CIOs and other senior level executives, these invitation-only programs offer timely topics and strong networking. Learn More »
Social Responsibility's Strategic Benefits
December 15, 11:30 AM - 12:30 PM US/Eastern (GMT-5)
Join Ed Granger-Happ, CIO of Save the Children, for a discussion of how creating an organization that is socially responsible improves staffing, retention, leadership development and overall corporate health.
Working With and Communicating to Your Board of Directors
January 13, 2009, 4:00 PM - 5:00 PM US/Eastern (GMT-5)
CIO panelists who will share tips and experiences working with their boards: Twila Day of SYSCO; Jeff O'Hare, West Corp.; Marc West, formerly with H&R Block.
IT's Role in Growing Mid-Market Companies
January 14, 4:00 PM - 5:00 PM ET (GMT-5)
Mid-market Council members will share their companies' stories and challenges in driving or coping with growth. Panelists represent Veterinary Pet Insurance, Medicis Pharmaceutical, and Intrax Cultural Exchange.
Learn more about the CIO Executive Council »
Apply today for a FREE subscription to CIO Magazine!
Researcher Finds New Way to Hack Oracle Database
Security researcher David Litchfield has released technical details of a new type of attack that could give a hacker access to an Oracle database.
April 24, 2008 — IDG News Service —
Security researcher David Litchfield has released technical details of a new type of attack that could give a hacker access to an Oracle database.
Called a lateral SQL injection, the attack could be used to gain database administrator privileges on an Oracle server in order to change or delete data or even install software, Litchfield said in an interview on Thursday.
Litchfield first disclosed this type of attack at the Black Hat Washington conference last February, but on Thursday he published a paper with technical details.
In a SQL injection, attackers create specially crafted search terms that trick the database into running SQL commands. Previously, security experts thought that SQL injections would only work if the attacker was inputting character strings into the database, but Litchfield has shown that the attack can work using new types of data, known as date and number data types.
Litchfield's attack targets the Procedural Language/SQL programming language used by Oracle developers.
A noted database hacker, Litchfield is best known as the researcher who published details on the bug used in the 2003 SQL Slammer worm, which targeted Microsoft's SQL Server database.
Litchfield wasn't sure how widespread lateral SQL injection vulnerabilities are, but he thinks the attack could cause real damage in some scenarios.
"If you happen to be using Oracle and you write your own applications on it, then yes, you could be writing vulnerable code," he said. "The sky is not falling ... but it's certainly something that people should be made aware of."
Database programmers should review their code to be sure it is checking to make sure that all of the data it is processing is legitimate, and not injected SQL commands, he said.
Oracle did not return a call seeking comment.
Copyright © 2008 IDG News Service. All rights reserved. IDG News Service is a trademark of International Data Group, Inc.
- Researcher: Half a Million Database Servers Have No Firewall
- CIO 20/20 Honorees--Innovator's Profile: Lawrence J. Ellison of Oracle Corp.
- Oracle's Database Machine: For Many It'll Be Much Pricier Than First Touted
- Ellison Pitches High-Speed Data Warehouse Server
- An Inside Look at Oracle's (and HP's) New Database in a Box and the 'Accelerator'
The Business of Managing Content: Xythos Document Management & Microsoft SharePoint
The Intelligent Enterprise
Mobility is Growing: Survey Shows Why CIOs are Concerned
The Move Toward Mobilization
Protecting the Code: Technology Escrows Safeguards Critical Software
Optimizing Infrastructure Control
Raising the Bar on Business Service Delivery: Best Practices in Application Performance
Optimizing Wide-Area Data Services Webcast
Why CIOs should embrace Web 2.0
Dashboard Strategies for Business Users
Grassroots Data Governance with SAP MDM
Building Competitive Advantage with Next-Generation Wireless Infrastructure
Resource Alerts
Get instant email notifications by topic when white papers, webcasts, and case studies are added to our library.
Palm Announces WebOS and Pre Phone
Nokia Ends Production of Its Only WiMax Device
FAQ: How to Get the Windows 7 Beta
HP Aims TouchSmart Desktop PC at Businesses
Red Hat to host Second Life-like virtual JBoss trade show
Windows 7 Public Beta to be Available Friday
Vietnam Pushes Open-Source Software for Government Use
Social networks link terrorists
Greenpeace still hunting for truly green electronics
Sony rolls out Atom-powered mini-laptop
Just the basics, please. Sometimes we all need a refresher or we need to make sure our team and our colleagues are all on the same page.
Over 25 tutorials on everything from business intelligence to virtualization.
- CIO|
- Computerworld|
- CSO|
- DEMO|
- Game Pro|
- Games.net|
- IDG|
- IDG UK|
- IDG Connect|
- IDG Tech Network |
- IDG World Expo|
- Industry Standard|
- InfoWorld|
- ITworld|
- JavaWorld|
- LinuxWorld|
- MacUser|
- Macworld|
- Network World|
- PC World|
- Playlist|
- CIO UK|
- CIO Germany|
- CIO China|
- CIO Sweden|
- CIO Australia|
- Other CIO Sites
